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A novel technique is devised to perform orthogonal state quantum key distribution. In this scheme, 

entangled parts of a quantum information carrier are sent from Alice to Bob through two quantum 

channels. However before the transmission, the orders of the quantum information carrier in one 

" " " channel is reordered so that Eve can not steal useful information. At the receiver's end, the order 
CO ' 

, of the quantum information carrier is restored. The order rearrangement operation in both parties 

■ is controlled by a prior shared control key which is used repeatedly in a quantum key distribution 

' session. 

bJQ' PACS numbers: 03.67.Dd,03.67.Hk 

' A complex telecommunication system connects any place at any time with pervasive intrusion in the world today. It 
0^ , is trivial to observe that information security is a fundamental issue today. The task of cryptography is to make secret 
(N . messages intelligible only for the two legitimate parties of the secret communication, Alice and Bob, and unreadable 
I for other unauthorized users such as Eve. To this end, Alice and Bob have to encrypt their secret messages using 
" ^ . a suitable encryption scheme. Thus far, the only proven secure crypto-system is the one-time-pad scheme, in which 
I the secret key is as long as the messages 0, ■ The security of the transmission of the secret messages using one- 
, time-pad depends ultimately on the key privacy. The security of key distribution is the most important part in 
T-H ' secret communication. Quantum key distribution (QKD), an approach exploiting quantum mechanics principles for 
OO , secret communication, provides a secure way for transmitting the key. A lot of attention has been focused on QKD 
O. IilllllllllililiS|ll|ll|ll|ll|ll|ll[l3 since the BB84QKD Wocolji ^and experimental studies on QKD 
^ ; have been developing very fast in the last two decades [11 [H lU lH I2II21 12112^. 

The security of QKD lies on the fundamental difference between classical and quantum information. Classical 
information can be copied freely and imperceptibley. However quantum information cannot be cloned ;27j . Any 
measurement will disturb the quantum state unless the quantum state is the measuring device's eigenstate. For a 
-j-J quantum state, Eve has only one chance to choose the right measuring device to avoid capture. The security of QKD 
^ protocols lies either on randomness, e.g. in BB84 j3| and similar protocols 4, 5, 6, 7] or the non- locality nature of 
^ quantum systems as in refs d 0, 0, . 

Non-locality is pertinent to quantum system only. Here a quantum state is split into two parts: e.g. the two parts 
• • of a photon wave packet 0, j o'" two correlated particles [l^ IT^ . We call them as quantum information carriers 
(QIC). In non-locality based QKD protocols, orthogonal quantum states are used. Security is assured by not allowing 
Eve to acquire both parts simultaneously. These protocols can be understood in Fig.l in ref 0, which is similar to 
Fig.l. Alice and Bob's sites are secure, and the transmission lines are insecure. Alice produces EPR pairs randomly 
5^ in one of entangled states. She then sends out the two parts of a QIC simultaneously through two paths to Bob. The 
lower QIC part is delayed first at Alice's site, and the upper QIC part is sent away without delay. At Bob's site, the 
upper part has a delay and the lower part has not, so the two parts of the QIC arrive at the detector simultaneously 
and are measured. These protocols use orthogonal states and have full efficiency; and all the particles transmitted 
can be used to generate secret keys. In Goldenberg-Vaidman scheme the time delay for the two correlated parts 
is usually longer than the transmission time between the practical distance so that the first QIC part has already 
reached Bob's secure field when the second part starts to run into the insecure line. To assure the security, Alice 
has to send the QIC in random timing. Koashi-Imoto protocol ^Jl uses an asymmetric interferometer instead of a 
symmetric interferometer, and the random timing can be dropped and the time-delay can be reduced. However, two 
factors make this delay cannot be too short. First there exists a detection time window for Eve in these protocols. 
If Eve acquires the same apparatus as Bob, which is usually assumed in security analysis, she can take an intercept- 
resend attack. She first intercepts a batch of lower QIC parts which reaches her first and stores them for a while, 
at the same time she sends fake lower QIC parts to Bob. After delay time t. Eve begins to receive corresponding 
upper QIC parts. Combining the QIC parts she keeps, she can make collective measurement and know the correct 
key completely. Afterwards she can send the correct messages to Bob. It is only in this delay time that Eve makes 
errors about the secret keys. Afterwards, Alice and Bob can only notice a backward shift of Bob's key string relative 
to Alice's. Secondly, Eve can take advantages of noises in noisy channel to gradually make up this shift. If the delay 
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time is not long, Eve can achieves this fairly quickly. Similar issues exist for other protocols that use orthogonal 
states. 

In this paper, we present a controlled order rearrangement encryption (CORE) technique for QKD with the state 
of a correlated system, such as entangled photon pairs. Here Alice rearranges the order of correlated particles and 
send them to Bob, and Bob then restores the order of the particles and recover the correct correlation and makes the 
right measurement. This is done in a controlled manner by the repeated use of a short control key as has been used in 
the modified BB84 scheme j7|, where Alice and Bob synchronize their measuring devices by repeatedly using a prior 
shared control key. 

To present our idea clearly, we use EPR pairs as the QIC in the rest of this paper for the sake of simplicity. The 
procedure and conclusions to other QIC's are very much the same with little or without any modification. An EPR 
pair can be in one of the four Bell states: 

1^") = 72(|0)a \^))b ~ |1>A 10)5 , |^+> - -^(|0)^ |1>5 + 10)5) 

\r) =7f(|0)^ 10)^-11)^ 11)5), 10+) =-L(|0)^ 10)^ + 11)^11)^) (1) 

where subscripts A and B indicate the two correlated photons in each pair. They can represent 00, 01, 10 and 11 
respectively. As in Fig.l, CORE technique uses two channels. Alice uses a modulator to prepare her EPR pairs 
randomly in the four Bell-basis states, and then sends out them in equal time intervals to Bob. Before these EPR 
pairs enter the insecure transmission lines, their orders are rearranged by a controUed-order-rearrangement-encryption 
system. After they arrive at Bob's site, they are de-arranged in Bob's site that undoes the effect of order rearrangement 
by Alice and then are measured. Fig. 2 shows the main idea of CORE by a specific example. Here are four choices of 
CORE operations. The CORE is done for every four EPR pairs. The upper QIC parts are transmitted according to 
their temporal ordering. A control key is used to rearrange the order of particles in the lower channel. If the value 
of control key is 00, operation Eq is applied and the order of the 4 EPR pairs are not changed as shown in Fig. 2 (a), 
which is implemented in the device in Fig. 2 (b) with switches 1, 2 and 3 in positions (up, up, down) for all the 4 EPR 
pairs. When control key is 01, Ei is performed, and it is done by putting the 3 switches into position (down, up, 
down), (up, down, up), (up, down, down), (up, down, up) for the four particles respectively. Similar combinations 
can be written explicitly for E2 and E3. After the order rearrangement, two particles that travel simultaneously 
through the two channels have complicated relations: they are correlated if the CORE operation is Eg, and they 
are anti-correlated if the other 3 CORE operations are used. At Bob's sites, we just exchange upper and lower part 
of Alice's CORE apparatus, and the CORE operation performed by Alice will be undone. After measurement, the 
information is read out. It is interest to emphasize that the measurement here is orthogonal basis measurement. The 
outcome is determinative, and is exactly the same as Alice has prepared. 

To prevent Eve stealing the information of the encryption ordering operation, one needs an evening process to make 
the time interval between different batches of QIC's travel at equal time intervals. 

Let's look at the security of CORE. We suppose that Eve has complete knowledge of Bob's measuring device except 
the control key. As she does not know which CORE operation Alice and Bob are doing each time, she can only guess 
randomly from the four CORE operations. Thus she has only 25% chance to choose the right CORE operation for 
every 4 EPR pairs. When Alice uses the wrong CORE operation, the two photons she measures will be anti-correlated, 
say the A particle from the first EPR pair and the B particle from the second EPR pair is mistreated by Eve as an 
EPR pair, then the density operator will be 
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where = TrBiipAiBi) and = Tr^i^ (PA2-B2) are the reduced density matrices of particle Ai and particle 
B2, respectively. When PA1B2 is measured in Bell-basis, the result can be any of the 4 Bell-basis states with 25% 
probability each. Thus Eve will introduce 3/4 x 3/4=56.25% error rate in the results. Alice and Bob can detect Eve 
easily by checking a sufficiently large subset of results randomly chosen. 

Surely, Eve can even take Bell inequality measurement on the photons, but it is useless for decrypting the control 
key. Let us choose two directions li'{ax,ay,az) and b {bx,by,bz) as the directions of measurement of Alice and Bob 
respectively. Then the correlation operator can be written as follow. 

E = a ■~a^ -1) (3) 
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a^bz az{bx-iby) {a^ - iay)bz [a^ - iay){hx - iby) 

az{bx + iby) -a^bz [a^ - iay){bx + iby) -{a^ - iay)bz 

{a^+iay)bz {a^ + iay){b^ ~ iby) -a^b^ -a^ib.^ - iby) ^' 

{ax + iay){bx + iby) -{ax+iay)bz -a^ibx+iby) a^b^ 

where a is the Pauh operator, '^a:~^]'o)''^^^(^i' 0*)'''^^~(^0 '^l) expectation value (^E{li , b 

(■01 d-li®a- b in state j?/;) is different for different Bell states. They are — [a^bx + CLyby + azbz), axbx + ayby — Qzbz, 
—ttxbx + ttyby + azbz and axbx — ayby + azbz in Bell states l^"), and respectively. For product states 

|0) |0), |0) |1) |0) and |1) |1), the expected values are azbz, —azbz, —azbz and azbz respectively. If Eve takes Bell 
inequality measurement on two uncorrelated photons in the CORE repeatedly, she will get for a large number of 
measurements as the photons is randomly distributed in the four product states. If Eve does takes two correlated 
photons, she will also get as the EPR pair takes the 4 Bell states with equal probability. In fact, the violation of 
Bell inequality holds for two photons in a a fixed Bell state. So Eve can get no information about the control key 
except for guessing it randomly. 

The control key is very important. Here we must emphasize that unlike classical one-time-pad, the control key for 
CORE can be quite short and be used repeatedly. This is surprising to a conventional cryptographer because it is 
well known that a one-time-pad key used twice will be of great danger. But it is a different story when quantum 
mechanics comes into play. There are fundamental differences in encryption between classical signal and quantum 
state. In classical encryption, signal can be copied freely and the copying process does not introduce error on the final 
results. Eve can exploit this freedom to eavesdrop in classical communication. In quantum physics, quantum states 
can be measured without disturbing the system only if they are eigenstates of the measuring operator. When Eve 
tries to measure the states without knowing if she is using the eigenstate operator, she will produce errors most of the 
time. The no-cloning theorem[22| forbids Eve to produce multiple copies to break the code by trial and error, and 
she has only one chance for a quantum state! Different from classical cryptography. Eve has no means to decipher 
the control key. She can only guess the control key randomly. The probability that Eve guesses the right control key 
is (1)^*° = where 2Nfe is the number of bits in the control key. When Nfc=100, the probability is practically 

zero. The security of the repeated use of a short control key has recently been proved[2^. It is shown that QKD 
without public announcement of basis is secure against both individual and coherent attacks. The proof could be 
applied to this CORE scheme with some modification. More detailed study needs be done to prove the security of 
the CORE scheme. 

The control key is short. A few hundreds bit is enough for many purposes. We can use a control key repeatedly 
in a single QKD session. The control key can be produced in many ways. Any sequence of secret numbers can 
be used as control key. They can be produced beforehand when Alice and Bob are in contact. But the preferred 
generating method is to produce them on-sites using the same physical setup. Instead of simultaneously choosing the 
same CORE operation, Alice and Bob choose their operation randomly. They record their results and the CORE 
operation they use each time. They have 25% chance to choose identical CORE operations. In these events, they 
should have identical results. After some transmissions, they publish their CORE operations, and retain those with 
identical CORE operations. They then perform eavesdropping check. If the error rate is lower than a threshold, they 
then conclude that their transmission is safe and then continue to perform he follow-up post-processing such as error 
correction and privacy amplification. Then they have a common secret random numbers that can be used as the 
control key. After the generation of the control key, Alice and Bob then switch to the synchronized operation CORE, 
which is much more efficient. Actually, the on-site generation of the control key is a BB84-type protocol, and the 
intrinsic is low. However, we need only to use this operation to generate a very short sequence key. The time it takes 
is negligible compared to the main process of a QKD process. 

The CORE technique is not only suitable for EPR pairs, but also suitable for other QIC's. The formalism used here 
can be directly translated into the wave-packet case as in refs Hini. In that case, the experimental implementation 
will be easier. In addition, CORE can be performed in groups. The control key can be used to control the CORE 
operation of a group of units. For instance, instead of using 01 controls CORE operation of one unit of QICs(4 EPR 
pairs) , one can use 01 to control the use of Ei for more units of QICs consecutively, say 4 units or 16 EPR pairs. 

The specific example of CORE in this paper uses only four simple permutation operations. The idea presented here 
can be easily extended to build more complicated systems. The essence of CORE technique is the repeated use of a 
control key to perform classical encryption on the quantum system. The non-cloning nature of quantum state ensures 
this technique viable. 

Though genuine single photon source has been realized in laboratorv|29l Isoj. at present highly attenuated laser 
pulses is used to approximate single photon source where only 1 out of 10 pulse contains a photon. The detection 
efficiency is not 100% either. As with other QKD schemes, we must perform eavesdropping check, and if the error rate 
is less than threshold the results are taken as the raw key. After quantum error correction and privacy amplification. 
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the raw key will be processed into ideal secret keys. 

To summarize, CORE technique can be used to perform secure key distribution with present technology in a 
controlled and efficient manner. It is worth mentioning, the discovery of security of repeated use of a short control 
keyj?! is very important. It enables quantum key distribution in a more efficient way. 

This work is supported by the National Fundamental Research Program Grant No. 001CB309308, China National 
Natural Science Foundation Grant No. 60073009, the Hang-Tian Science Fund, and the Excellent Young University 
Teachers' Fund of Education Ministry of China. 
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FIG. 1: Illustration of a typical QKD s}' 




FIG. 2: A specific example of CORE with EPR pairs, (a) Four difi"erent CORE operations, (b) Device to perform CORE 
operations. The loop represents a time delay of a fixed interval. 



